Cyber Sentinel
Secure Real-Time Communication Platform
Cyber Sentinel is a resilient, real-time messaging architecture combining Spring Boot, Redis Pub/Sub, and STOMP WebSockets with proactive threat detection. By pairing high-speed K-Means anomaly clustering with Google Gemini AI contextual analysis, the platform intercepts malicious API floods, credential brute-forcing, and anomalous traffic patterns at the gateway before they degrade messaging infrastructure.
Spring Boot & STOMP WebSockets
Full-duplex bidirectional communication with Redis Pub/Sub broadcast and TTL-based ephemeral room reclamation.
K-Means Anomaly Clustering
High-speed Euclidean outlier distance calculation flagging volumetric traffic surges and protocol anomalies in microseconds.
Google Gemini AI Analysis
Synthesizes packet signatures, user agent distributions, and request entropy to execute automated edge mitigations.
Messaging & Threat Mitigation Architecture
Parallel inspection isolating legitimate WebSocket/STOMP traffic from edge threats before backend message propagation.
Browser & mobile clients connecting over secure WSS
Full-duplex frame negotiation with heartbeat monitoring
Centralized TLS termination, auth validation, and routing
Distributed room broadcasting with automatic TTL expiry
Message delivery to subscribed participants
Rate Violation
Outlier Cluster C4
Pattern Identified
Edge Filter Applied
Simulated Threat Ingress & Edge Interception
Trigger high-frequency API floods, brute-force dictionary attacks, volumetric spikes, or protocol fuzzing to inspect automated mitigation.
Unsupervised Outlier Centroid Isolation
Traffic vectors projected across request frequency, entropy variance, and socket persistence metrics.
Automated Threat Synthesis & Intent Classification
Spring Cloud Gateway Action Executed
Dynamic IP throttle applied at Spring Cloud Gateway; socket connection dropped and ephemeral room key invalidated.
Categorized Architecture Stack
Key Systems Decisions & Justifications
Temporary chat rooms do not need permanent relational database storage. Redis Pub/Sub delivers sub-millisecond multi-client broadcast while TTL keys automatically clean up dormant rooms without requiring expensive periodic database cron purges.
Terminating WebSocket handshakes and client traffic at a dedicated gateway layer prevents unauthenticated packets from ever reaching backend services. It centralizes IP rate-limiting, authentication, and threat inspection in a single perimeter.
Sending raw traffic directly to an LLM is cost-prohibitive and slow. Unsupervised K-Means clustering flags statistical outliers in microsecond timeframes. Once an outlier is flagged, Gemini AI analyzes the packet narrative and user context to distinguish malicious attacks from benign flash crowds.